PHP discloses narrow RCE risk after PHP2Shell emergency fixes
PHP has warned of a separate potential remote-code-execution issue, tracked as CVE-2026-115560, two days after releasing emergency fixes for the critical PHP2Shell vulnerabilities. The October 23 informational advisory says the newly disclosed path affects only web applications using a specific and uncommon session configuration.
The issue is distinct from CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell flaws fixed in emergency releases on October 21. Those flaws allowed an unauthenticated attacker to execute code on a server and were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Updating to those releases does not itself address CVE-2026-115560.
A narrow sequence creates the exposure
PHP says an application is exposed through this path only when several conditions occur together. Its session.serialize_handler setting must initially be configured as php_binary or php_serialize, then changed at runtime to php using ini_set() before the application calls session_start().
Session upload progress must also remain enabled. This feature is enabled by default and allows an application to track the progress of a file upload. An application that does not change its session serialization handler while it is running can keep session upload progress enabled without being exposed through this particular route.
Mitigation is available before a routine fix
PHP does not plan an emergency release for CVE-2026-115560 because it considers the affected configuration unlikely in practice. It recommends disabling session upload progress until a routine bugfix release is available by setting session.upload_progress.enabled=0.
The same configuration setting was already listed as a mitigation in PHP's October 21 advisory for CVE-2026-109619. Organisations that applied that setting at the time and kept it enabled do not need an additional mitigation for the newly reported issue.
What remains unknown
PHP has not identified the affected versions, the releases that will contain the fix, or a severity score for CVE-2026-115560. It has also not said whether the issue shares a root cause with CVE-2026-109619. A full advisory is planned with the next regular release.
No exploitation of CVE-2026-115560 has been reported. The attacks reported since October 21 target the earlier PHP2Shell vulnerabilities. For businesses running PHP applications, the immediate task is to verify deployment of the PHP2Shell patches, disable session upload progress where appropriate, and audit code for runtime changes to the session serialization handler.